Data protection & your rights.
Understanding your data protection rights under GDPR and how to exercise them.
Under the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018, you have several important rights regarding your personal data. This page explains these rights and how you can exercise them with ProMCQ
Your data protection rights
Right of access
You have the right to request a copy of the personal data we hold about you. This includes:
- Your account information and profile data
- Study progress and performance analytics
- Communication history with our support team
- Payment and access-pass information
Right to rectification
You can request that we correct any inaccurate or incomplete personal data. You can update most information directly through your account settings, or contact us for assistance.
Right to erasure ('right to be forgotten')
You can request deletion of your personal data in certain circumstances:
- When the data is no longer necessary for our original purpose
- When you withdraw consent and there's no other legal basis for processing
- When the data has been unlawfully processed
- To comply with a legal obligation
Note: We may need to retain some data for legal obligations or legitimate business purposes.
Right to restrict processing
You can request that we limit how we use your data while we resolve issues such as:
- Disputes about data accuracy
- Unlawful processing that you don't want deleted
- Data needed for legal claims
- Objections to processing while we verify our legitimate grounds
Right to data portability
You can request a copy of your data in a commonly used, machine-readable format. This applies to data you've provided to us based on consent or contract, including:
- Account and profile information
- Personal notes, highlights and bookmarks
- Question, flashcard and mock-exam progress
- Study plan and sponsorship records
Right to object
You can object to processing of your personal data for:
- Direct marketing (including profiling for marketing)
- Processing based on legitimate interests
- Scientific/historical research or statistical purposes
Right to withdraw consent
Where processing is based on consent, you can withdraw that consent at any time. This includes consent for marketing communications, analytics, or optional features. Withdrawal doesn't affect the lawfulness of processing before withdrawal.
How to exercise your rights
Online account management
Many rights can be exercised directly through your account:
- Update personal information (Account)
- Download your data as JSON (Account → Your data)
- Withdraw analytics consent (Cookie settings)
- Choose whether a sponsoring organisation sees your progress (Account)
- Delete your account (Account)
Contact our support team
For more complex requests or assistance:
Email: support@promcq.com
Subject: Data Protection Request
Response time: Within 30 days
Identity verification
To protect your privacy, we may need to verify your identity before processing certain requests. This may involve confirming details from your account or asking for additional identification.
Response timeframes
| Request type | Standard response | Complex cases |
|---|---|---|
| Data access | Within 30 days | Up to 60 days with notification |
| Data correction | Within 7 days | Within 30 days |
| Data deletion | Within 30 days | Legal review may extend to 60 days |
| Data portability | Within 30 days | Up to 60 days for large datasets |
Data protection officer
For complex data protection matters or if you're not satisfied with our response to your request, you can contact our Data Protection Officer:
Email: support@promcq.com
Subject: DPO - Data Protection Inquiry
Address: GK's Study Centre LLC, Data Protection Officer
Filing a complaint
If you believe we have not handled your personal data in accordance with data protection laws, you have the right to lodge a complaint with the relevant supervisory authority:
UK users
Authority: Information Commissioner's Office (ICO)
Website: ico.org.uk
Phone: 0303 123 1113
EU users
Authority: Your national data protection authority
Directory: edpb.europa.eu/about-edpb/about-edpb/members_en
International data transfers
Some of our service providers are located outside the UK and EU. When we transfer your data internationally, we ensure appropriate safeguards are in place:
- Adequacy decisions by the European Commission
- Standard Contractual Clauses (SCCs)
- Binding Corporate Rules
- Certification schemes and codes of conduct
Last updated: 5 September 2026